Please submit only technical tips that will help other TidBITS readers better use their Macs, iPhones, iPads, and related software and hardware. All product announcements should be sent to releases@tidbits.com.

Tip title*

Your tip*

URL

Enter the URL to a Web page that supports your tip.

Linked text

Enter the name of the page linked above.

Your name*

Your email*

* indicates required fields

To help us avoid automated posts and spam, please enter the words below.

When you submit a tip, you give us permission to use it. Read our terms for more details. All submissions are reviewed before publication.

Our terms: By submitting a tip, you agree to assign TidBITS Publishing Inc., a non-exclusive, worldwide, perpetual license to reproduce, publish, and distribute your tip in connection with the TidBITS Web site and associated products in any media. You agree that you created the content you submitted, and that you have the right to assign us this license. You give us permission to use your name, but your email address won't be publicly displayed or shared. We review all submissions before publication, and reserve the right to select which submissions we feel are appropriate for our readers and to edit those we publish.

Our terms: We reserve the right to edit or delete any comment, so please post thoughtfully. We use your email address only to send you a one-time verification message confirming that you posted this comment. We also store your address to allow you to verify using other Web browsers in the future. For more info, see our privacy policy.

1Password 4 for Mac Better Than Ever

Back in December 2012, AgileBits overhauled its popular 1Password password management app for iOS (see “1Password 4 for iOS: Overhauled and Improved,” 12 December 2012), and now the same treatment comes to the Mac, with 1Password 4. The upgrade is free for all Mac App Store purchasers and anyone who bought directly from AgileBits on or after 1 January 2013. For everyone else, there’s a temporary launch sale, where you can upgrade for $24.99 (regularly $34.99) or purchase a new license for $39.99 (regularly $49.99).

For those not in the know, 1Password is an app for Mac OS X, iOS, Windows, and Android that stores your login credentials and other sensitive information in an encrypted database. Using browser extensions, it can learn your logins as you log in to Web sites and autofill them later with a couple of clicks or keystrokes. Most importantly, it can generate long, random passwords that are impossible to guess.

In this day and age, I cannot overemphasize how important it is to have an app like 1Password. A couple of weeks ago, I received email from eBay informing me that my account had been compromised. I promptly changed my password, using one generated by 1Password. Reviewing my old password, I realized that it was one of my old “lazy passwords” that I should have changed long ago. These passwords were significantly complex, using a mix of cases, letters, and numbers, but I reused the same handful of passwords across multiple Web sites. That worked just fine ten years ago, but in the age of seemingly daily hacks and password leaks (see “Adobe Announces Major Security Breach,” 7 October
2013), such a technique doesn’t cut the mustard. Each and every login needs to be both unique and complex or you’re setting yourself up for a world of pain.

There are numerous apps that generate, store, and enter secure passwords for you, but if you’re firmly entrenched in Apple’s ecosystem, I think 1Password is the way to go, because AgileBits’ main focus is on Mac OS X and iOS. Yes, there are versions for Windows and Android, but they don’t match up to the features of the flagship Mac version. If you’re largely a cross-platform user, you might prefer the open-source Keepass or the cloud-based LastPass. However, I’ve used them both in the past, and neither is as elegant as 1Password. (If you’re an
occasional Linux or Windows user, you can open your 1Password database file in a Web browser, a feature called 1PasswordAnywhere. Thoughtful features like that are what set 1Password apart.)

Another reason I like 1Password is that AgileBits is an international team, making NSA interference difficult to either implement or keep under wraps. See “1Password Developer Responds to NSA Concerns” (12 September 2013) for the company’s response to the recent NSA domestic surveillance revelations.

So that’s the skinny if you don’t already use 1Password. For 1Password veterans, here are the best new features of 1Password 4.

A New Look -- The first thing you’ll notice is that 1Password 4 has been redesigned to look more like 1Password 4 for iOS. The icon has transformed from a key to a keyhole. Overall, 1Password 4 features much lighter tones than its predecessor, which is evident from the initial login screen. AgileBits says that the new, lighter look places a greater emphasis on the content instead of the interface.

Multiple Vaults -- Perhaps the most important new feature is the capability to create and share multiple password databases, which 1Password calls “vaults.” This feature is fantastic, since I can share a vault containing banking information with my wife, but keep my work passwords separate.

There’s even an option to create a demo vault full of dummy information, so technology writers like yours truly can show you 1Password without having to come up with fake data. (Psst… the password is “demo”.)

To create a new vault, choose 1Password 4 > New Vault. To switch between vaults, choose 1Password 4 > Switch to Vault and choose your desired vault from the menu. Or, you can click the 1Password icon in the upper-left of the window.

Each vault can have its own individual sync settings. To do so, just open the desired vault, then choose 1Password > Preferences > Sync. You can do this via the menu, but you really should learn the Command-, shortcut, since it will open preferences in just about every Mac app.

1Password mini -- In 1Password 3, you had only two options to retrieve a password: fish it out of a browser extension or launch the full 1Password app. 1Password 4 introduces 1Password mini, a companion app that lets you quickly access your passwords at any time, without opening the full app. It can appear in your menu bar or as a separate window, invoked with a keyboard shortcut.

Click the key icon in your menu bar or press Command-Option-\ and you’ll be prompted to enter your password. Here’s a trick: click the keyhole on the password entry pane to switch between vaults.

In 1Password mini, you can search for and view all of your passwords and even generate new ones. If a password entry has a URL attached, one click opens the Web site in your default browser.

If you need to copy and paste more than one piece of information (for example, pasting your username and password into an app where the browser extensions can’t reach), click the anchor and you can keep that password window open indefinitely, even as you switch apps.

You’ll also notice a new feature carried over from the iOS app: favorites. To set a login as a favorite, open an entry in 1Password and click the star under its name. That copies the login to the Favorites category, making it even more easily accessibly in 1Password mini or the iOS app.

Wi-Fi Sync -- A feature I’m giddy to see return is the capability to sync 1Password between the Mac and iOS over a local Wi-Fi connection, a feature that was dropped on 1Password 4 for iOS. I (and many others) complained loudly at the time, and fortunately, it looks like AgileBits paid attention. (Wi-Fi Sync is currently awaiting an update to the iOS app.)

Why is this feature so important? Because I’ve never been crazy about storing my entire password database on Dropbox’s servers. (iCloud sync is also an option in 1Password 4.) Sure, 1Password uses strong 256-bit encryption and files are additionally encrypted on Dropbox, but I’d still prefer to keep my 1Password data on machines I control entirely. I’d rather the bad guys not have access to my most important lockbox, even if I don’t believe they can open it. In this case, a “bad guy” is anyone that isn’t me or my wife, including Dropbox, Apple, and the NSA and their custom encryption-breaking chips.

Sure, you’ve always been able to copy data over a USB connection with iTunes File Sharing. But it’s only a one-way copy, not a sync, and who wants to have to fool with that terrible interface? 1Password’s Wi-Fi Sync is a perfect blend of security and convenience.

To activate Wi-Fi Sync, open 1Password 4 and choose Window > Wi-Fi Sync (or press Option-9). You’re presented with a secret passcode to enter into the iOS app to initiate pairing. On your iOS device, open 1Password 4, then go to Settings > Sync > Wi-Fi to enter the code and establish syncing. Wi-Fi Sync works only when the iOS app is open and unlocked and when the Wi-Fi Sync window is open on the Mac.

Security Audit -- Finally, we come to what I consider 1Password 4’s killer feature: Security Audit. It’s the single best new feature for anyone with even an inkling of interest in security, which should include you.

Security Audit warns you of weak passwords, duplicate passwords, and old passwords that you might want to consider changing, if the site allows stronger passwords than when you initially created your password. (There’s no reason to change passwords regularly, if they’re sufficiently strong.) Even better, Security Audit is dead-simple to use, since it’s basically just a set of smart folders that reveal which of your passwords need help. Hover over the Security Audit item in the sidebar, click Show to reveal its collections, and click the group you want to see. Once you have a password you want to change, log in to the Change Password page on the site in question, generate a new password, and use it to replace the old one in
1Password.

It’s an ingenious feature, and if you use it wisely, it will greatly improve your online security.

Locking It Up -- This is just a taste of what 1Password 4 has to offer. I didn’t even get to its improved password sorting, support for iCloud and custom folder syncing, and improved consistency between browser extensions. With all of these improvements and refinements, getting the new version is a no-brainer if you’re entitled to a free upgrade, and if not, there’s never been a better time to invest in 1Password. It’s one of the best investments you can make in your online security.

And if you’d like expert advice on using 1Password, including the new sync options, multiple vaults, 1Password mini, Security Audit, and numerous other new features, our own Joe Kissell is here to help with his new book, “Take Control of 1Password,” written with the support of AgileBits during 1Password 4’s beta testing period. This book picks up where Joe’s earlier and more general book, the best-selling “Take Control of Your Passwords,” leaves off, explaining how to get the most from 1Password 4 on the Mac, along with help for using it in iOS, Windows, and Android.

Check out the Take Control ebooks that expand on the topic in this article:

Slowed down by entering passwords repeatedly? Learn how to let 1Password do the heavy lifting. With directions for 1Password 4 for the Mac, as well as 1Password for iOS, Windows, and Android, author Joe Kissell makes it easy to generate and use secure passwords, speed up online shopping, and share and sync Web logins and other confidential data.

Password overload has driven many of us to take dangerous shortcuts. If you think ZombieCat12 is a secure password, that you can safely reuse a password, or that no one would try to steal your password…think again! Overcome password frustration with expert advice from Joe Kissell, and don't miss our Joe of Tech comic or Joe’s intro video!

CrashPlan is easy, secure backup that works everywhere. Back up
to your own drives, friends, and online with unlimited storage.
With 30 days free, backing up is one resolution you can keep.
Your life is digital; back it up! <http://tid.bl.it/code42-tb>

Comments about 1Password 4 for Mac Better Than Ever(Comments are closed.)

Hi M. Perry, I don't know how useful it would be if you actually needed to produce your driver's license, but you can scan your license and then "attach" the PDF to a driver's license entry in 1Password. Choose File > New Item > Drivers' License, and then drag the attachment over the default image in the new item. There's a default image in pretty much every 1Password item, and you can drag PDFs into an item by dropping them on the default image. Or the Notes field.

I think Mavericks will be out soon enough that you could just wait a bit to see. iCloud Keychain will probably be sufficient for minimal use of synced logins, but something like 1Password will likely still be highly welcome if you're used to using browsers other than Safari (at first, anyway), storing data other than passwords, and so on.

Assuming no bugs or iCloud glitches, the forthcoming iCloud keychain should work nicely for storing Web login information, your basic contact information, and your credit card details (though not your 3-digit security code). And, you'll be able to input all that information into a Web form in the Safari app on a Mavericks Mac or iOS 7 device. And, if that's all you need for password management and efficient online shopping, you may not need 1Password at all! But, 1Password goes way beyond iCloud keychain, giving you the ability to access your passwords in other Web browsers, via older Apple OSes, on Android or Windows devices, or (optionally) just via a Web browser. You can create multiple vaults and share them. You can store your credit card security code. You can store many more types of confidential data. Etc.

Thanks for this very informative article. I'm surprised that SplashID Safe isn't mentioned in this or pretty much any other article about password manager apps, as it's been around for ages, and has had wifi sync for a couple of years at least. I've been happily using it for over a decade, though it went through some very substantial upgrade problems recently, something else I was surprised didn't get any coverage. In light of those problems, this article is all the more timely, though it would be nice to know if there was a straightforward way to migrate info from one app to another.

Last time I checked into SplashID, there was no Mountain Lion version. Plus it's overall feature set was smaller than 1Password's. Those two facts together made it a less interesting option, overall. However, I see that they released a Mountain Lion version in early August of this year! The new version presumably has more features, though their website doesn't detail the features in an obvious place. For example, it doesn't mention anything about what browsers it works with. My understanding is that previous versions of SplashID worked only with Safari.

At the moment, 1Password 4 on the Mac can import only .1pif files (1Password Interchange format). According to the text of Joe's "Take Control of 1Password" ebook, "Additional import and export options are reportedly coming soon to the Mac version."

Some time ago I bought 1Password Pro 3 for iOS. It was advertised as being able to sync passwords between iOS devices via DropBox. Turned out this was NOT possible without also using the Mac application. Since I did not want to spend even more money I abandoned 1Password and switched to SecureSafe which is based in Switserland so I think it is safe from organizations like the NSA.SecureSafe can be accessed with a web browser on any platform, on iOS and Android with an app. You can have a free account if your requirements are modest or a choice of paid subscribtions depending on your needs.A unique (as far as I know) feature is that you can appoint beneficiaries, people you trust who can unlock your account with a code (seperate from your password). You can set a period before your account is actually unlocked and you are notified when the unlock process is activated. A safe way to release important documents when something happens to you.I recommend taking a look at securesafe.com

I've also been using SecureSafe for some time. Since I've been on the Mac platform for over 25 years, I still have a few pre-Lion essential apps that are keeping me on Snow Leopard. Therefore some of the other password solutions don't work for me, and I like all the SecureSafe features you've mentioned -- including the fact that it's free for my needs.

I've been an avid fan and user of 1Password for years and was an early purchaser of v4 while it was just a twinkling in Agile's eyes. However, there has been some significant pain early on in the release of version 4. I still cannot obtain all their browser extensions. The Safari extension worked day 1, thank you. But only today have I been able to get the Chromium (I don't use Google's Chrome) extension. I'm still battling to get the Firefox extension due to SSL errors and I can't even get Agile's website to resolve correctly in Firefox 24, and that's even after turning off ALL my Firefox extensions and restarting the browser. Not good. There are also aspects of the old GUI I would like to have been able to save. Then consider the general annoyance of having to DIY remove the version 3 extensions for web browsers. Seriously? Granny doesn't like that, I can tell you. IOW: There are a few 'Version 1.0 Syndrome' problems going on that I wish would be solved yesterday. Not a clean rollout.

I found a contorted workaround for getting the 1Password 4 extension for Firefox downloaded, installed and working. I'm fine. I doubt may other people are. Therefore, I wrote detailed notes and sent them to Agile this evening. I have asked them to fix 4 specific things this week. I'm sorry I can't paste in the details here as they are far too long. But Agile should set things right this week as I've found them to be very responsive.

I heard from Agile yesterday. They acknowledged the problems, provided an explanation, and hope that they currently have the problems repaired in order to allow the ability to add the 1Password extension to Firefox. They've also taken my request for an automated method of removing the old 1Password extensions, rather than forcing DIY removal, under advisement. That will please dear old granny.

I made the mistake of "upgrading" from 1P3 to 1P4 on my iPad and it caused all sorts of havoc with it and 1PwdMac. Took about a week to get my 1Pwd data back and I immediately deleted 1P4 and went back to 1P3. The worst problem was they deleted the ability to sync DIRECTLY between the iOS app and the Mac app using my own isolated secure WiFi network and it was their new sync procedure that deleted all my data. I'm staying away from 1P4.

With all the rave reviews of 1 Password 4 I was wondering if I was the only person to have had problems. I have yet to see anything except positively glowing reviews. My 1Password file had over 900 items. When I ran the update it found my dropbox file. The problem -- there were only 10 items. Everything else was missing. I uninstalled and used a backup file I created just in case. The really irritating thing is I've sent 2 emails to support and nothing back from the Agile folks. If everything were going so swimmingly with this launch I would have hoped for some "support" from support. I've bought numerous licenses and paid upgrades and re-bought in the Mac App store for the convenience and promise of the free upgrade to version 4. I also bought countless iOS versions and paid upgrades. This lack of consideration from AgileBits makes me question how much more I want to support them.

I'm not certain the problem is a lack of consideration from AgileBits as much as them not testing their update system adequately as well as not taking into account the fact that non-geek users would like to use their product. This is entirely in keeping with the attitude of coding geeks that they are providing software FOR coding geeks, and they are NOT. They required a bank of ordinary users to perform QA in order to thrash out the bugs and poor procedure planning. My impression from chatting with them via email is that they got BURNED by their bad upgrade system as evidenced by a deluge of email complaints. They have taken this under consideration and ARE responding as nicely as possible. I've never had a bad interaction with their support staff, which in this day and age of default customer disrespect within the business community is quite remarkable. Good luck getting most tech companies these days to give a rat's. (Hello Samsung!) But blunder Agile did indeed.

Sorry to hear of these problems. I'll look into them. FWIW, I upgraded from 1Password 3 to the 1Password 4 beta, then the MAS version, with no issues. And this was an old file that had originated in Keepass, had been exported into LastPass, then exported again into 1Password for Windows, then 1Password 3 for Mac, etc.

Hopefully they'll get back to you very soon! I know they've been overwhelmed with the release - even if things have gone swimmingly for the vast majority of users, they have so many users that problems experienced by only a small percentage of users will still add up to a large number.

Steve, I had a major problem with 1P4 in that it DELETED my database from 1Pwd on my iMac. Their support was helpful EVENTUALLY but things like asking me to do something then report back aren't helpful when they decide to take a couple days off before responding. Oh, I also had found a copy of my database on a Time Machine back-up and was able to get up and running in the interim while waiting for for them to get back to me - only to be told I should NOT do anything before they tell me to do so and to NOT use TM back-up copies. Anyway, 1P4 is gone-gone-gone from my Mac & iDevices. If 1P3 ever stops working, I'll go back to a spreadsheet of all my data and enter passwords manually; it's too important to leave to buggy software and an increasingly non-responsive support.